Secure document  storage system

ABSTRACT

A system is provided for the storage of data, the system having: an encrypted host platform disposed in a specific territory and upon which export controlled data is stored; a controller configured to allow a primary user to set permission settings and identify authorized end users and degrees of access granted to each the authorized end user, the authorized end user being pre-cleared for compliance with export controls pertaining to the export controlled data; the controller configured to permit access to the encrypted host platform only if the host platform is located within a specific territory and if the hosting platform is in compliance with predefined data security protocols the controller configured to allow the authorized end user access to the export controlled data, and the controller configured to exclude access to both a provider of the system for storage and a system host platform provider; at least one individual computing device accessible by at least one the authorized end user, disposed within an authorized territory, the individual computing device configured to provide authorized end user identification data to the controller and receive permissions from the controller for access to the host platform; and the host platform only communicates with individual user devices if the devices have received permission from the controller.

RELATED APPLICATIONS

This application is a continuation of U.S. application Ser. No.15/223,461 filed on Jul. 29, 2016, which claims the benefit of U.S.Provisional Application No. 62/282,266 filed Jul. 29, 2015. Theseapplications are herein incorporated by reference in their entirety forall purposes.

FIELD OF THE INVENTION

The invention relates to cloud storage solutions, and more particularly,to a cloud storage solution with integrated security protocols toprevent unauthorized exportation of sensitive technical data.

BACKGROUND OF THE INVENTION

Technical data relating to munitions and other war material generated inthe United States must be handled in compliance with InternationalTraffic in Arms Regulations (ITAR) issued by the Directorate of DefenseTrade Controls (DDTC) of the US State Department. Increasingly,companies are reliant on cloud and other electronic document handlingsystems for the management of technical data. This is problematic inrelation to ITAR regulated data for a number of reasons. It is generallyrecognized that commercially available public cloud document and filestorage, management and collaboration systems contain a comprehensiverange of features and enterprise quality security that are impracticalif not impossible to design, implement and maintain by any singleenterprise or organization for its own documents and purposes. Somecommercially available pubic cloud systems merely contain features andfunctions that reflect a rich and leveraged history of solving amultitude of needs and concerns with regard to the storage, managementand collaboration of documents and files, but also they are continuallyenhanced to incorporate the best available security and updated featuresat competitively maintained prices. These commercial offerings areconsistently greater in function and far less in cost than those ofcompanies not competing in this industry can achieve through their ownindividual efforts.

Unfortunately, these “best of breed” public cloud storage, managementand collaboration solutions, as well as the specific functionalityincorporated within these solutions, some of which could enhancecompliance with export laws and the administration and reporting ofexport licenses and technical assistance agreements granted for theexport of ITAR-defined technical data, have not been available for usewhere documents and files contain ITAR-defined technical data. The veryfeatures of shared platforms, cloud disbursement of data, and ubiquity(and therefore anonymity) of access that have been viewed as positiveattributes of cloud solutions generally have been viewed instead asantithetical to the ITAR. Use of these resources has been judged asautomatically resulting in what the ITAR categorizes as “deemedexports,” that is impermissible exports that will be deemed to haveoccurred because the possessor of export-controlled technical data didnot take reasonable steps to preclude such occurrence.

As a consequence of the unavailability to those possessing documentswith ITAR-defined technical data of leading public cloud document andfile storage, management and collaboration subscription solutions, thosepossessing such technical data have been forced to implement various,inadequate alternatives. Some have avoided any electronic storage ofITAR-defined technical data, maintaining only “paper” copies ofdocuments and materials containing such data. Others have maintainedelectronic copies, but have done so often in non-encrypted formats andhoped that through stealth and luck those documents and files would notbe disseminated in violation of the ITAR.

Still other enterprises and organizations have attempted to implementand maintain “dark clouds,” which are private computer networks thatattempt to capture some of the security, efficiencies and functionalityof the best commercial offerings. Such offerings, however, have asubstantially greater cost and significantly less functionality andsecurity than could be available in the market from commercial providersif not for the “ITAR” prohibition.

Deficiencies in known systems indicate that: (1) there would besubstantial cost savings, enhanced security, and less administrativeburden if companies dealing with documents and files containingITAR-defined technical data could collaborate in the use of thosedocuments and files via common cloud computing practices that are widelyrecognized at the enterprise level as “best-in-class” to foster highproductivity, performance and regulatory compliance; (2) encryption anduse restrictions alone are not sufficient to achieve ITAR compliancewhen using cloud solutions; and (3) the cost of non-compliance, andtherefore the lack of a solution to the unavailability of a leadingcommercial document and file collaboration solution, is high.

Accordingly, there exists a need for a fully functional, publiccloud-based document and file storage, management and collaborationsystem for documents and files containing ITAR-defined technical data.

SUMMARY OF THE INVENTION

One embodiment of the present invention provides a system for thestorage of data, the system comprising: an encrypted host platformdisposed in a specific territory and upon which export controlled datais stored; a controller configured to allow a primary user to setpermission settings and identify authorized end users and degrees ofaccess granted to each the authorized end user, the authorized end userbeing pre-cleared for compliance with export controls pertaining to theexport controlled data; the controller configured to permit access tothe encrypted host platform only if the host platform is located withina specific territory and if the hosting platform is in compliance withpredefined data security protocols the controller configured to allowthe authorized end user access to the export controlled data, and thecontroller configured to exclude access to both a provider of the systemfor storage and a system host platform provider; at least one individualcomputing device accessible by at least one the authorized end user,disposed within an authorized territory, the individual computing deviceconfigured to provide authorized end user identification data to thecontroller and receive permissions from the controller for access to thehost platform; and the host platform only communicates with individualuser devices if the devices have received permission from thecontroller.

Another embodiment of the present invention provides a such a systemwherein the controller compiles logs of all actions on the systemrelating to controlled technical data disposed on the host platform.

A further embodiment of the present invention provides a such a systemwherein the audit trails are tamperproof.

Yet another embodiment of the present invention provides a such a systemwherein the controller is configured to provide real-time reports to anenterprise administrator of access points granted to controlledtechnical data disposed on the host platform.

A yet further embodiment of the present invention provides a such asystem wherein the real-time reports provide automated alerts to theenterprise administrator.

Still another embodiment of the present invention provides a such asystem wherein the controller is configured to require two-factorauthentication of individual computing devices.

A still further embodiment of the present invention provides a such asystem wherein the controller provided granular permissions to theindividual computing devices.

Even another embodiment of the present invention provides a such asystem further comprising an encrypted email service disposed on theencrypted host platform.

An even further embodiment of the present invention provides a such asystem wherein hardware specifications of an authorized user aredetermined on initial authorization and further access by the authorizeduser is limited to the specific hardware configuration used for theinitial authorization.

Yet still another embodiment of the present invention provides a such asystem wherein hardware specifications comprise information regardingthe CPU, BIOS, motherboard, and operating system.

A yet still further embodiment of the present invention provides a sucha system wherein access by an authorized user from a different hardwareconfiguration than that used for initial authorization would result inthe user being prompted for additional information.

Yet even another embodiment of the present invention provides a such asystem wherein the additional information comprises information providedthrough two-factor authentication or two-channel authentication.

A yet even further embodiment of the present invention provides a such asystem further comprising a master key configured to allow secondaryaccess to the system.

Even yet another embodiment of the present invention provides a such asystem wherein the master key is split into a plurality of files, all ofwhich must be combined to allow access to the system.

An even yet further embodiment of the present invention provides a sucha system wherein the plurality of master keys are held by citizens ofthe territory in which the hosting platform is located.

Still yet another embodiment of the present invention provides a such asystem wherein the controller provides access to the system only tocitizens and permanent residents of the specific territory.

A still yet further embodiment of the present invention provides a sucha system wherein the system is accessible via distributed computernetwork located entirely within the specific territory.

Still even another embodiment of the present invention provides a such asystem wherein the specific territory is the United States of America.

A still even yet further embodiment of the present invention provides asuch a system further comprising a reporting module, configured toelectronically record and report transmittal of the controlled dataoutside of the specific territory.

Another embodiment of the present invention provides a such a systemwherein the specific territory and the authorized territory are thesame.

The features and advantages described herein are not all-inclusive and,in particular, many additional features and advantages will be apparentto one of ordinary skill in the art in view of the drawings,specification, and claims. Moreover, it should be noted that thelanguage used in the specification has been principally selected forreadability and instructional purposes, and not to limit the scope ofthe inventive subject matter.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram illustrating a Secure Document Storage Systemconfigured in accordance with one embodiment of the present invention.

FIG. 2 is a block diagram illustrating a secure document storage systemwith an enterprise controller configured in accordance with oneembodiment of the present invention.

FIG. 3 is a block diagram illustrating a secure document storage systemwith an enterprise controller and tamper proof auditing and on requestreporting configured in accordance with one embodiment of the presentinvention.

FIG. 4 is a block diagram illustrating a the system architecture of asecure document storage system configured in accordance with oneembodiment of the present invention.

DETAILED DESCRIPTION

As illustrated in FIG. 1, one embodiment of the present invention isprovided. FIG. 1 depicts a document and file storage, management, andcollaboration ITAR-compliant hosting platform 16 within a third partyhosting platform 20, both of which platforms are physically located onservers or similar devices, which are located within the territory ofthe United States of America and serviced and maintained by UnitedStates citizens or persons in the United States legally (“US persons”).Some embodiments of the present invention may be configured for storageand communication of classified data as well as controlled data.Furthermore, all installation, support, ongoing maintenance and systemupgrade activities of the ITAR Hosting Platform 16 and its cloudcomputing environment is performed exclusively by US persons who areemployed by US employers and supervised by other US persons. Thiscontrol may part of the implementation of the system according to oneembodiment of the present invention and, consequently, dictates how data(customer content) is handled by the application provider and thehosting platform provider. In such a system, the ITAR-compliant hostingplatform 16 may receive certificates from the application provider andthe hosting platform provider confirming compliance, and/or may track IPaddresses and other geographic indicia to monitor host location andaccess points. In some embodiments, confirmation of user nationality andgeographic location could be automated to track transmission of data,verify user URL, employee privacy makes citizenship problematic;periodically check names and information

Such embodiments could provide individual lists with training supportmaintenance consulting and third party certification that no names areon a preclusion list. Alternatively, they could provide access to apreclusion list to the customer to allow them to vet their own users.

Such a platform 16 may be configured with software, firmware, orhardware that prevents unauthorized access of technical data by IT staffand platform providers. Users of a system configured according with oneembodiment of the present invention would be assured by the system thatneither the application provider not the hosting provider will violatethe US persons/locale requirement; this also means that, through use bycustomers of the user and document permissions features that controlaccess, use, movement, etc. of both users and documents, the customercan ensure that non-US Persons do not have non-regulatory compliantaccess or possible access to documents containing controlled technicaldata.

Embodiments of the present disclosure may identify the hardwareassociated with an authorized user. Hardware identification may comprisethe identification of one or more hardware components of an authorizeduser's system, including the CPU, bios and motherboard and may vary fromspecific identification to identification of general characteristics ofsuch hardware. A change in the hardware configuration of an authorizeduser may, in embodiments, be used to prevent the user's access to theencrypted data, trigger an alert or prompt the user to authorize the newconfiguration for access. Two-factor authentication, single use pins,two-channel authentication or other enhanced-security measures, as wouldbe known to those of ordinary skill in the art, may be used toreauthorize a changed hardware configuration in some embodiments.

Controlled technical data may only be accessed by such US persons orpersons permitted by a federal government issued export license orapproved technical assistance agreement. The system according to oneembodiment of the present invention, controls for this in two ways:

-   -   1. Through the implementation of the application provider and        hosting provider controls described above with regard to US        hosting local; US Persons; US transit of documents containing        ITAR-defined technical data; and    -   2. Through user and document restrictions (also referred to as        permissions) that the customer can place on both users and        documents, the customer can ensure its users that those        documents are not accessible, are not used, and are not moved        except in compliance with US export documents, such as an Export        License, a Technical Assistance Agreement (TAA), or a Master        License Agreement (MLA).

The ITAR Hosting Platform 16 referenced in FIG. 1 maintains ITAR-definedtechnical data in encrypted format. In various embodiments of thepresent invention, encryption may be Encryption at rest (storedcontent): 256 bit AES encryption (Rijndael algorithm) Encryption intransit: up to 256 bit SSL encryption (https transfer). The encryptionof documents stored on the system configured according to one embodimentof the present invention, ensures compliance with TLS standard 1.0.(Transport Layer Security (TLS) is a protocol that provides privacy anddata integrity between two communicating applications. It's the mostwidely deployed security protocol used today, and is used for Webbrowsers and other applications that require data to be securelyexchanged over a network, such as file transfers, VPN connections,instant messaging and voice over IP).

Embodiments of the present disclosure may also provide multilevel keymanagement. Such embodiments may utilize a unique dataroom key, whichmay be generated during creation of a dataroom, which, in embodiments,may be synonymous with the secure viewer discussed elsewhere in thepresent disclosure. In other embodiments, a dataroom may be used hereinto refer, generally, to the secure connection between a host platformand an authorized user. Such a dataroom key may be used to encryptdocuments and be itself stored in an encrypted file system. The dataroomkey may be further encrypted with a master key, which, in embodiments,is split into multiple parts, without all of which the informationencrypted therewith may not be decrypted. Such a master key may bedistributed between several persons to provide enhanced security. Inembodiments, where a specific citizenship may be required for access tothe underlying data, the persons having portions of the master key mayall be of a uniform citizenship of the type required for authorizedaccess. In other embodiments, the master key holders may be seniorofficials of the hosting platform organization.

Encryption implements a Multilevel Encryption Key Management, asfollows:

-   -   1. Unique data room-key which is generated when the data room is        created    -   2. Documents are encrypted with the applicable data room key and        stored in file system (256 bit AES encryption)    -   3. The data room key is encrypted with the system master key    -   4. The master key is generated during installation of the        customer's data room center that allows for the creation of one        or a multitude of data rooms.

FIG. 1 further illustrates ITAR-defined technical data 22 beingtransmitted in encrypted format between a secured private database 14,such as might be maintained by private or governmental organization, tothe ITAR Hosting Platform. It should be understood that the embodimentsof the present invention may be deployed on various database platformsand are not limited to specific database architectures.

In the embodiment illustrated in FIG. 1, individual Computing devices 18controlled by users are permitted by the enterprise or organization, asdefined in a controller 12 that controls the secured private database14, to access the technical data in the Hosting Platform 16 and therebyreceive controlled technical data from, and transmit controlledtechnical data to, the ITAR-compliant Hosting Platform 16 in encryptedform and in compliance with the established rules.

As illustrated in FIG. 2, an enterprise controlling the secured privatedatabase configured according to one embodiment of the present inventioncontrols the transmission of controlled technical data to and from theControlled Hosting Platform from that secured private database and itspermitted users (those using individual computing devices), as well asby controlling who will be, and who will continue as a permitted user).

As illustrated in FIG. 3, a system 10 configured according to oneembodiment of the present invention is provided for cloud basedcontrolled file storage with tamper proofing and auto reportingfunctionalities. In the system, an enterprise controller 12 controlsindividual access 18, a database 14, and an ITAR Platform 16. Thecontroller 12 provides tamper proof auditing of ITAR hosting platform16. This tamper proofing is a result of limitations on the system suchthat the system is not accessible for editing or elimination by acustomer. In embodiments, customers are not allowed access to thatportion of the application that could be used to edit or eliminateinformation on users, documents and events in the use of the document.Encrypted technical data 22 is transferred between the ITAR-complianthosting platform 16 and technical data secure database 14. Individualcomputing devices 18, which may include but are not limited to personalcomputers, workstations, mobile phones, tablets, smart watches, orsimilar devices, may, subject to permissions granted by the controller12, access the ITAR-compliant Hosting Platform 16 and access ITAR datafrom it securely.

As illustrated in FIG. 4, a host platform architecture may be providedcomprising a firewall 30, a load balancer 32, dual application servers34,36, dual AD-Controllers 38,40, a Network Attached Storage Device 42and a Database server 44. A second firewall 46 may also be disposedbetween the application severs 34,36 and the AD-Controllers 38,40,Database Server 44, and Network attached storage 42. Those of ordinaryskill in the art would be aware of other configurations that wouldprovide comparable security and access.

In one embodiment of the present invention, technical information isprovided to a user on an individual computing device via a secureviewer. One such viewer is described in U.S. Pat. No. 7,865,827, whichis incorporated by reference herein in its entirety for all purposes.Such a viewer allows the user to review documents, but not download themor store them locally. Similarly, displayed documents may haveintegrated watermark features, either visible to the user or occult.Watermarks may be dynamic, in that they may change during the course ofviewing so as to embed user, time, location, device, and other data, soas to provide evidence in case of breach. Furthermore, the system isconfigured to trace each action and provide documentation to auditors orenterprise administrators. As the view interactacts with the controller,the controller is able to compartmentalize technical data andpermissions in a highly granular way, facilitating permissions forspecific tasks, documents, document viewing, and document storage. Theseuse restrictions are chosen by the subscriber to the service withregards to individual users, user groups, datarooms, dataroom centers,and documents and files within and comprising such technical data. Sucha system may be configured with an encoded email or similar messagingsystem.

The foregoing description of the embodiments of the invention has beenpresented for the purposes of illustration and description. It is notintended to be exhaustive or to limit the invention to the precise formdisclosed. Many modifications and variations are possible in light ofthis disclosure. It is intended that the scope of the invention belimited not by this detailed description, but rather by the claimsappended hereto.

What is claimed is:
 1. A system for the storage of data, the systemcomprising: an encrypted host platform disposed in a specific territoryand upon which export controlled data is stored; a controller configuredto allow a primary user to set permission settings and identifyauthorized end users and degrees of access granted to each saidauthorized end user, said authorized end user being pre-cleared forcompliance with export controls pertaining to said export controlleddata; said controller configured to permit access to said encrypted hostplatform only if said host platform is located within said specificterritory and said hosting platform is in compliance with predefineddata security protocols, said controller being further configured toallow said authorized end user access to said export controlled data inaccordance with said permission settings and degrees of access grantedthereto, and said controller configured to exclude access to both aprovider of the system for storage and a system host platform provider;and at least one individual computing device accessible by at least onesaid authorized end user, disposed within an authorized territory, saidindividual computing device configured to provide authorized end useridentification data to said controller and receive permissions from saidcontroller for access to said host platform; wherein said host platformonly communicates with individual user devices if said devices havereceived permission from said controller.
 2. The system of claim 1wherein said controller compiles logs of all actions on said systemrelating to controlled technical data disposed on said host platform. 3.The system of claim 2 wherein said logs are tamperproof.
 4. The systemof claim 1 wherein said controller is configured to provide real-timereports to an enterprise administrator of access points granted tocontrolled technical data disposed on said host platform.
 5. The systemof claim 4 wherein said real-time reports provide automated alerts tosaid enterprise administrator.
 6. The system of claim 1 wherein saidcontroller is configured to require two-factor authentication ofindividual computing devices.
 7. The system of claim 1 wherein saidcontroller provided granular permissions to said individual computingdevices.
 8. The system of claim 1 further comprising an encrypted emailservice disposed on said encrypted host platform.
 9. The system of claim1 wherein hardware specifications of an authorized user are determinedon initial authorization and further access by said authorized user islimited to the specific hardware configuration used for said initialauthorization.
 10. The system of claim 9 wherein hardware specificationscomprise information regarding the CPU, BIOS, motherboard, and operatingsystem.
 11. The system of claim 9 wherein access by an authorized userfrom a different hardware configuration than that used for initialauthorization would result in the user being prompted for additionalinformation.
 12. The system of claim 10 wherein said additionalinformation comprises information provided through two-factorauthentication or two-channel authentication.
 13. The system of claim 1further comprising a master key configured to allow secondary access tothe system.
 14. The system of claim 13 wherein said master key is splitinto a plurality of files, all of which must be combined to allow accessto the system.
 15. The system of claim 14 wherein said plurality ofmaster key files are held by citizens of the territory in which thehosting platform is located.
 16. The system of claim 1 wherein saidcontroller provides access to said system only to citizens and permanentresidents of said specific territory.
 17. The system of claim 1 whereinsaid system is accessible via distributed computer network locatedentirely within said specific territory.
 18. The system of claim 1wherein said specific territory is the United States of America.
 19. Thesystem of claim 1 further comprising a reporting module, configured toelectronically record and report transmittal of said controlled dataoutside of said specific territory.
 20. The system according to claim 1wherein said specific territory and said authorized territory are thesame.